Repository navigation
Bundled brotli is still 1.2.0 in 2.56.0.windows.3 (CVE-2026-111497 is fixed in 1.2.1) #6514
Description
Existing issues matching what you're seeing
- I was not able to find an open or closed issue matching what I'm seeing
Git for Windows version
git version 2.56.0.windows.3
cpu: x86_64
built from commit: 0e9926caea36270e3e9067b5ac512ac0335a004a
libcurl: 8.23.0
OpenSSL: OpenSSL 3.5.9 29 Sep 2026
zlib: 1.3.2
Windows version
Windows 11
Windows CPU architecture
x86_64 (64-bit)
Additional Windows version information
Microsoft Windows [Version 10.0.26300.9711]
Options set during installation
Path Option: Cmd
SSH Option: OpenSSH
CURL Option: WinSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Use Credential Manager: Enabled
Performance Tweaks FSCache: Enabled
Other interesting things
On my installation of 2.56.0.windows.3, the bundled curl and brotli executables both report Brotli 1.2.0. Upstream fixed CVE-2026-111497, an out-of-bounds write, in Brotli 1.2.1 (google/brotli v1.2.1, published 2026-10-21). The fix is commit 0ed4268a, cherry-picked into the 1.2.1 release as b418fa81. MSYS2 moved mingw-w64-brotli to 1.2.1 on 2026-10-22 (msys2/MINGW-packages#32794). I can't tell from the version strings whether the fix was backported into the bundled 1.2.0.
Git turns on libcurl's automatic response decompression (CURLOPT_ENCODING "" in http.c), so when the libcurl Git loads has Brotli support, responses marked Content-Encoding: br are decoded by it.
Could the bundled brotli be updated to 1.2.1?
Terminal/shell
Bash (Git Bash)
Commands that trigger the issue
"C:\Program Files\Git\ucrt64\bin\curl.exe" -V
"C:\Program Files\Git\ucrt64\bin\brotli.exe" --version
Expected behaviour
The bundled brotli is 1.2.1 or later, so curl -V lists brotli/1.2.1 and brotli --version prints brotli 1.2.1.
Actual behaviour
WARNING: this libcurl is Debug-enabled, do not use in production
curl 8.23.0 (x86_64-w64-mingw32) libcurl/8.23.0 Schannel zlib/1.3.2 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.5 libssh2/1.11.1 WinLDAP
brotli 1.2.0
Repository
Not repository specific.
Activity
dscho commentedon Oct 24, 2026
I just saw that. We missed that package (without knowing about that vulnerability in brotli, of course) by mere hours when preparing the coordinated release with Git LFS. Yesterday, the word on the street was still that this was "only" node2shell, and therefore Git for Windows looked unaffected.
Let's see what other terrible vulnerabilities are discovered this weekend, and release Git for Windows v2.56.0(4) on Monday.
I really fear that this cadence of ill-executed disclosures, in conjunction with the necessary steady stream of security updates in Git for Windows will cause quite the upgrade fatigue.
Sora-bluesky commentedon Oct 25, 2026
Thanks for the quick reply, and for planning v2.56.0(4) for Monday. That timing makes sense to me. I'll check the bundled curl and brotli versions once it's out and report back here.
dscho commentedon Oct 25, 2026
FWIW the latest snapshot already comes with the fixed brotli:
Sora-bluesky commentedon Oct 25, 2026
Thanks for checking the snapshot. I'll wait for v2.56.0(4) and post the bundled curl and brotli versions here once it's out.
dscho commentedon Oct 26, 2026
/add relnote bug Upgrades the included brotli component to v1.2.1 to address CVE-2026-111497.
The workflow run was started
Add a release note (bug)
dscho commentedon Oct 26, 2026
@Sora-bluesky actually, there is an easier way: Git for Windows' release automation records those versions:
Sora-bluesky commentedon Oct 26, 2026
Thanks, @dscho, for pointing me to the recorded versions and for the quick release. I've installed v2.56.0.windows.4 here, and
etc/package-versions.txtshowsmingw-w64-ucrt-x86_64-brotli 1.2.1-1andcurl 8.23.0-1, so this is resolved on my end.radiabu55shanb-dot commentedon Oct 31, 2026
bash "/c/Users/radia/Documents/Codex/2026-10-31/files-mentioned-by-the-user-b/work/B Studio/B Studio/ملفات لكلود/install.sh"